Hybrid Cryptoschemes and Public Key Authentication

Overview Hybrid Cryptoschemes and Public Key Authentication Lesson contents Alessandro Barenghi Hybrid Cryptosystems Digital Certificates Dipartimento di Elettronica, Informazione e Bioingegneria (DEI) Politecnico di Milano The Web of Trust model alessandro.barenghi - at - polimi.it G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 1 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 2 / 47 Communication security Issues The trivial solution Does it scale? Alice and Bob want to have a confidential, authenticated Problem 1: To communicate with n people, Alice needs to communication. know/store n separate keys: key storage is an issue Trivial solution: they meet in person, and exchange a secret key k Problem 2: To communicate with someone, Alice needs to meet From the meeting point on, they use a symmetric cipher to encrypt him/her in person once, or have a secure communication channel their communications A A Solution: Alice generates an asymmetric keypair kpub; kpri and makes Confidentiality is achieved, authentication is implicit from the secrecy A B B kpub available, and so does Bob generating kpub; kpri of the symmetric key To communicate with Bob, Alice signs the message with kA , and This was the only solution possible up to 1976, as only symmetric pri encrypts it with kB ciphers were available pub G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 3 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 4 / 47 Efficiency issues Cryptographic Hash Hybrid cryptosystems A non-encrypting cryptographic primitive Asymmetric ciphers are slow (≈ 100kiB/s on a desktop): encryption A hash is a deterministic function from arbitrary length message m, and signature of large messages are unpractical to fixed length output h = H(m) Build a hybrid cryptosystem using multiple cryptographic primitives Practically used to obtain a fixed-length \label" h for a digital object Encryption: Alice generates a random symmetric key k, encrypts the B The same value of h may be the hash of different messages (no such message with it, and encrypts k with kpub B thing as bijective arbitrary size ! fixed size compression) Decryption: Bob decrypts k using kpri , and uses it to decrypt the message, after which he may discards k. For a cryptographic hash it should not be practically feasible to: Signature: Alice should sign something smaller than the whole 1 Given h, find a m such that H(m) = h (1st preimage) message, although uniquely bound to it in some way 2 Given a message m, find m0 such that H(m0) = H(m) (2nd preimage) 3 Find two messages m0; m00 such that H(m0) = H(m00) (collision) Solving the efficient signature problem requires a new cryptographic primitive, the cryptographic hash Note that 1st preimage ) 2nd preimage ) collision, G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 5 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 6 / 47 One last(ing) issue Digital certificates What are digital certificates? Public key authentication Digital certificates are designed mimicking an actual paper certificate Hybrid cryptoschemes allow efficient, confidential communication for the information we want to authenticate Crucial assumption: Alice and Bob are employing each other's public Our purpose is to authenticate the binding of a public key to the key to send the messages identity of someone/some company If no measures are taken, it is easy to perform an impersonation The format for standardised digital certificates is defined through a attack on public key cryptosystems formal language through Abstract Syntax Notation One (ASN.1) We need some form of digital certificate of authenticity of public The contents of a digital certificate and their semantic values are keys specified employing ASN.1 in the X.509 Standard by ITU-T We will see solutions to this issue, and the infrastructures built to (International Telecommunication Union) manage their lifecycle (certificate issuing-use-revocation-expiration) The certificate signatures are performed employing signing the output of a cryptographic hash with an asymmetric primitive G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 7 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 8 / 47 Digital certificates Digital certificates Contents The X.509 standard mandates the certificate for the digital signature Format to contain the following information: The digital certificates are commonly exchanged as files Version and Serial Number : Used identify the certificate and specify Most common encoding: Distinguished Encoding Rules (DER, ITU the accepted extensions X.690) specifies a binary encoding format for the certificate Subject: The person, or entity to which the key belongs. DER encoding includes non printable characters, Issuer: The entity that verified the information and issued the certificate. The DER encoded certificate may be encoded in Base64 yielding data Valid-From/Valid-To: The validity period of the certificate. that can be copy-pasted easily (common file extension: PEM) Key-Usage: Purpose of the public key (e.g. encryption, signature Parsing certificates should be done carefully: string fields may contain verification on data, signature verification on certificates...). also non-printable characters (strings stored as length+content) Public Key: The public key to be bound to the subject. Signature Algorithm: The algorithm used to sign the hash of the certificate and the hash algorithm. Signature: The actual signature of the hash of the certificate. G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 9 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 10 / 47 Digital certificates Digital certificates How is it signed? The signature is performed through hashing part of the certificate and signing the digest as per RFC 5280. Certificate inspection The parts of the certificate which must be signed include: Inspecting X.509 certificates manually requires a pretty-printer Version and Serial Number Modern browsers include a summary pretty printer Subject, Issuer and Validity dates The public key to be certified The openssl library client performs prettyprinting if used as: Some of the certificate extensions (e.g. key usage) openssl x509 -inform DER -in <cert.der> -noout -text The signature process takes as input the aforementioned fields, A decoder for DER files can be found at http://lapo.it/asn1js/ Issuer encoded in DER in order, hashes them and signs the hash with kpri RFC 5280 specifies that either OS2IP (a custom sequence of bytewise additions!) or PKCS1 standard hashing must be used In practice, PKCS1 is the most common choice since it mandates the use of a cryptographically strong hash G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 11 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 12 / 47 Digital certificates Practical key sizes A brief primer on security margins Possible issues A proper security margin is ensured choosing a large enough keyspace The signature is reliable iff the employed hash is collision-resistant for all the ciphers involved and the signature algorithm is not broken The table obtained from the estimates at www.keylength.com by One of the most common choices for the hash was MD5 both academia and national standard bodies Today, computing a collision for MD5 takes ≈ 10s on this laptop Safe Secret/Private Key length [b] Given a message m1, you can derive a colliding message is in the form m = m jjpad, where pad is a properly chosen 64 B string up to RSA ECDSA DSA AES 2 1 year (key/group) Equiv. Certificates signed with MD5 can be forged taking a valid certificate, 1986 512 111 122/515 60 changing the desired values, and stuffing the pad as the comment 2010 1024 144 144/1024 80 field in the certificate extensions (last part to be fed to MD5) 2030 2048 224 224/2048 112 More of this to come in the lesson on cryptographic hashes 2060 4440 256 256/4440 128 Fores. Future 26268 512 512/26268 256 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 13 / 47 G. Pelosi, A. Barenghi (DEI) Hybrid Cryptoschemes and Public Key Authentication 14 / 47 Digital certificates PKI Infrastructure Who signs the certificates? Roles Certification Authority (CA): An entity (typically a firm) which \Someone trusted" signs the certificate, vouching for its authenticity takes care of signing the certificates, and distributes its public key to To provide this trusted entity, three solutions have been proposed: all the users in a trusted manner PKI: Public Key Infrastructure:A centralized, tree structured architecture of entities which sign certificates of their subsiders. The Registration Authority (RA): An entity (again, usually a firm) root authorities are implicitly trusted which takes care of verifying the actual authenticity of a certificate, WoT: Web-of-Trust:A distributed architecture relying on the \small gathering data on the user (physically checking his/her identity and world assumption" where everyone can sign certificates. The trust on certificate hash). Very often, it coincides with the CA the authenticity of a certificate is established depending on the trust on User: Asks the CA to sign his certificate, or employs the CA public the authenticity of its signers keys to verify the authenticity of the certificates for another user. G. Pelosi, A. Barenghi (DEI) Hybrid

Load more